/**
 * Allowlist-based HTML sanitizer (#149).
 *
 * Two tiers:
 * - **lenient**: for authored/authorized content — allows structural, text,
 *   table, list, and inline-style tags. Still strips script/iframe/object/on*.
 * - **strict**: for LLM-generated content — tighter tag set, no forms, and
 *   link rewriting (all hrefs become in-app IE navigation).
 *
 * Both tiers strip: `<script>`, `<iframe>`, `<object>`, `<embed>`, `<applet>`,
 * `<meta http-equiv="refresh">`, all `on*` event attributes, `javascript:` URIs,
 * external resource URLs (only `data:` images pass through).
 */
export type SanitizeTier = 'lenient' | 'strict';
export interface SanitizeOptions {
    tier: SanitizeTier;
    /** Max outbound links to keep (strict tier only, default 8). */
    maxLinks?: number;
    /** Callback to rewrite hrefs for in-app navigation (strict tier). */
    rewriteHref?: (href: string) => string;
}
/**
 * Sanitize HTML using DOM parsing and an allowlist walker.
 * Safe to call in a browser environment only (uses DOMParser).
 */
export declare function sanitizeHtml(html: string, options: SanitizeOptions): string;